GhostSocks

Malware actors were playing a fourth game: opportunistic distribution. Fake repositories dressed as leaked Claude Code delivered Vidar v18.7 and GhostSocks to anyone who downloaded them.

Search engines increased the exposure of the malicious repository ... The repository’s llms.txt and topic taxonomy were designed to be discovered by both classical search engines and large-language-model-powered search.

For web searches such as “DeepSeek v4 weights GitHub,” the malicious repository and its forks were positioned among top results, at times appearing ahead of official references like the Hugging Face release page.

The widespread availability of the proprietary code has created a massive vector for supply chain attacks. Cybercriminals are now actively weaponizing this incident, creating malicious forks designed to compromise developer workstations.

This was a campaign that used DeepSeek’s name as a lure, not a compromise of legitimate DeepSeek code or accounts.

Beyond routing attacker traffic through residential connections, it also includes a backdoor component that allows operators to run arbitrary commands and deploy additional malicious payloads on infected systems.

GhostSocks executes this command with PowerShell, which means defenders should be on the lookout for the above command string as it could be indicative of a GhostSocks infection.

A malicious GitHub repository published by idbzoomh uses the Claude Code exposure as a lure to trick people into downloading malware... Once it's executed, the malware drops Vidar v18.7 and GhostSocks onto users' machines.

Fake repositories dressed as leaked Claude Code delivered Vidar v18.7 and GhostSocks to anyone who downloaded them.

This mechanism, which can be viewed below and leverages registry run keys, allows for GhostSocks infections to survive restarts, allowing for a more long-lasting proxy uptime.

This mechanism, which can be viewed below and leverages registry run keys, allows for GhostSocks infections to survive restarts, allowing for a more long-lasting proxy uptime.

Some of these values are obfuscated using GhostSock’s custom obfuscation algorithm, which splits each string into four (4) byte chunks and then uses arithmetic shifts to reveal the deobfuscated text... After GhostSocks assembles its JSON configuration dictionary, it encrypts the dictionary with XOR using the key “config”

The activity relied on impersonation tactics to appear legitimate. The repository copied public benchmark data from the official release, used search-optimized naming and tags, and copied official branding.

Using this feature, actors are able to easily leverage LummaC2’s “Google Expired Token Refresh” feature in conjunction with the residential proxies to refresh expired Google tokens, even when a victim has changed their password.

After GhostSocks assembles its JSON configuration dictionary, it encrypts the dictionary with XOR using the key “config” and sends it to one of the C2s contained in its hardcoded C2 list in a basic request... While older samples communicate over HTTP, newer samples have been spotted leveraging HTTPS...

using a collaboration with GhostSocks, LummaC2 now allows actors to infect victims with reverse proxy binaries to turn their victims into residential proxies.

GhostSocks hijacks the victim’s internet connection to make attacker traffic appear as though it is coming from a regular household user... it uses the SOCKS5 proxy protocol to create a covert communication channel on infected devices, while a relay-based command-and-control (C2) architecture places an intermediary server between the attacker’s real C2 infrastructure and the compromised machine.

Within four hours, victims were downloading malware associated with Vidar infostealer and GhostSocks proxy malware.

GhostSocks has the ability to change these C2s on the fly following the initial check-in... GhostSocks also has the ability to insert new IPs if a given IP is taken down, or if a bot is using outdated IPs, allowing for more resilience than a single hardcoded config.

Once GhostSocks receives the relay server IP and port, it opens the same port on its victim machine, establishes connection with the relay server IP for backconnect traffic, and then wraps TLS 1.3 on top of all traffic that it sends and receives from the relay server.